长城防火墙有多强大？衡量中国的DNS审查制度
How Great is the Great Firewall? Measuring China's DNS Censorship
摘要：
中国防火墙（GFW）的DNS过滤设备在过去二十年中有了很大的发展。然而，大多数之前对中国DNS过滤的研究都是在短时间内进行的，导致GFW行为的变化未被注意到。在这项研究中，我们介绍了GFWatch，这是一个大规模的纵向测量平台，每天能够测试数亿个域，从而能够持续监控GFW的DNS过滤行为。我们展示了在九个月的时间内运行GFWatch的结果，在此期间，我们平均每天测试4.11亿个域名，并检测到GFW的DNS过滤器审查了31.1万个域名。据我们所知，这是文献中发现的最大数量的测试和审查域。我们进一步对GFW使用的正则表达式进行逆向工程，并找到41K与这些过滤器匹配的无害域，从而导致其内容的过度阻塞。我们还观察到GFW注入的伪造IPv6和全球可路由IPv4地址，包括Facebook、Dropbox和Twitter等美国公司拥有的地址。使用GFWatch的数据，我们研究了GFW封锁对全球DNS系统的影响。我们发现，在流行的公共DNS解析器（如Google和Cloudflare）中，有77K个被审查的域名的DNS资源记录被污染。最后，我们提出了检测中毒响应的策略，可以（1）从公共DNS解析器的缓存中清除中毒的DNS记录，以及（2）协助开发规避工具以绕过GFW的DNS审查。
英文摘要：
The DNS filtering apparatus of China's Great Firewall (GFW) has evolved considerably over the past two decades. However, most prior studies of China's DNS filtering were performed over short time periods, leading to unnoticed changes in the GFW's behavior. In this study, we introduce GFWatch, a large-scale, longitudinal measurement platform capable of testing hundreds of millions of domains daily, enabling continuous monitoring of the GFW's DNS filtering behavior. We present the results of running GFWatch over a nine-month period, during which we tested an average of 411M domains per day and detected a total of 311K domains censored by GFW's DNS filter. To the best of our knowledge, this is the largest number of domains tested and censored domains discovered in the literature. We further reverse engineer regular expressions used by the GFW and find 41K innocuous domains that match these filters, resulting in overblocking of their content. We also observe bogus IPv6 and globally routable IPv4 addresses injected by the GFW, including addresses owned by US companies, such as Facebook, Dropbox, and Twitter. Using data from GFWatch, we studied the impact of GFW blocking on the global DNS system. We found 77K censored domains with DNS resource records polluted in popular public DNS resolvers, such as Google and Cloudflare. Finally, we propose strategies to detect poisoned responses that can (1) sanitize poisoned DNS records from the cache of public DNS resolvers, and (2) assist in the development of circumvention tools to bypass the GFW's DNS censorship.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
